I’d be interested to know what others think of what this article says about passkeys and whether they should actually be used.
2 Likes
tl;dr: attested passkeys can be used by platforms to force users into software they wouldn’t choose themselves.
We already have this kind of limitation with exactly the same services the author mentions. You can’t watch Netflix with all features just in any browser — it requires a specific DRM module. I don’t see why this is a big deal: in those cases we either use a specific browser for specific platforms or avoid platforms that demand things we don’t want to do.
So on first reading it sounds like "don’t use web browsers because some websites might require one specific browser and you shouldn’t be forced to use software you haven’t chosen.”
Am I missing something?
It seems to be a technically informed piece, but if I’m being kind, I’d call a bit of it speculation at best, or conspiracy brained at worst. And in some instances, it’s misleading, especially the on we don’t have real control over our passkeys, that attestation allows websites to inspect or prohibit arbitrary software, or that passkeys are somehow going to force everyone onto approved operating systems. There’s a pretty big leap between what the technology is capable of and what the author is suggesting will happen.
2 Likes
it’s misleading, especially the on we don’t have real control over our passkeys
It’s truly misleading. At the same time I can see where it comes from. There are edge cases with passkeys where I genuinely stop understanding what’s happening. Like why 2FA passkeys for Proton work when created in Google Password Manager but not in KeePass. Why PRF works on a device but stops when used from another device via Bluetooth, and so on.
We’re probably still in the early stages of standardization, so it feels a lot less straightforward, which likely leads to this kind of conspiracy thinking
1 Like
Ah, I knew that this Substack post would pop up on our Discourse at some point. A nice read for sure, but also an audacious one (it ain’t easy attacking the supposedly new go-to authentication standard on the clear internet).
Here we are then, there are definitely things to be discussed about it.
As an example, I didn’t know the existence of some of the mentioned flags and mechanisms developed by FIDO for the WebAuthn API that make passkeys what they are today.
Also, I get the mood in the comment sections. Like some cliché meetings could have been summarised in one email, I do agree that the post could have been shorter, while also making sure not to give the feeling of reverse-UNOing your initial critical analysis (aka what was demonised at the beginning of the article ends up becoming less evil/more positively endorsed when you’re done with your reading). By the end of the paper, it’s then not surprising that some readers feel like the whole thing only reinforced the general trust we’ve been putting so far in passkeys (me included).
That being said, I think there are two things to retain from the post:
- If you do trust your 2FA TOTP system already in place (including of course your authenticator app of choice, be it Ente Auth or else), you don’t have to be forced to switch to passkeys. This system is safe, for as long as the 2FA is a real 2FA (generated on a separate device, which can even be isolated/put offline if necessary) and still combined with a strong password (that you will, of course, save in your favourite password manager
) - FIDO has laid down the tools that could allow some of the big ones[1] to force their users to switch to a passkey, and so enforce some remote policies that aren’t compatible with a total sovereignty and control over your credentials (that always comes with any other type of authentication system). Knowing who is a member of the FIDO Alliance, this is not a surprise for anyone. Right?
- I lied. There’s a third take: hail to our venerable hardware keys that still give us the same industry standard level of protection we deserve, while also being FIDO2 compliant. The good old YubiKeys are still undefeated, but if I may give a quick shoutout to a real, cheaper alternative to Yubico, here’s token2. For half the price of a YubiKey, you can get a Swiss-made (gov-compliant if needed) hardware security key that works exactly like your good old YubiKeys. And their support is also top-notch.
Pro tip, only for the most adventurous: you can also use your hardware crypto wallet, like the Trezor Safe 7 or any other Trezor (only the Model One isn’t FIDO2 compliant), as a FIDO2/U2F security key. Works like a charm.
No, I’m not gonna start a thread on the Ledger ongoing apocalypse, that will be for another time. Just know that it’s bad. Like, really, really bad. Like, the whole EU Market may be compromised.
So. To summarise:
- Enjoyable read, liked the writing style and tone of the author.
- Learned a few new things that went below my (our?) radar, regarding the few hypothetically problematic flags.
- For now, I don’t necessarily feel in danger of being trapped in an ecosystem. I trapped myself voluntarily by joining the Apple Silicon revolution 5 years ago, and the usage of passkeys with the secured enclaves of all of my devices has been blissful so far.
- Whenever possible, I always add one or two backups of my passkeys to my hardware security keys or crypto-thingy.
- Remember people: back in 2018, Google erased their motto “Don’t be evil” from the preface of their of code of conduct, while retained it in the last sentence. Think what you want about this, but I would be surprised if the vast majority of us, in our community, would nowadays blindly trust any of these big tech companies.
Sooo, see you on Fluxer @jonah ? Thanks to your email, I am finally back. Never meant to leave in the first place, but life was on the way and another Discourse community unexpectedly took all of my focus away for a few months. So, to everyone who was super nice to me with my very first post in the forum, thanks again for the kindness 
I’m looking forward to (re)start a regular activity in the community.
PS: @Sorge let’s just hope that this standardisation won’t become yet another mess like, I don’t know, what happened with the introduction of the USB-C. “One cable to rule them all…” they said… but who knows if the inside of The cable is made of optical glass or made of thin air.
(AMAMX? Where are we with the letters these days?) ↩︎
4 Likes
oh, I guess there’ll be a few more years of mess. Right now I need one more backup YubiKey, but I can’t bring myself to buy it because of the coming PQC update and the mess that’ll follow:
— some websites switching to the new standard while others still require old passkeys
— YubiKey finding bugs in the first generations of PQC firmware and asking you to buy new ones, and so on
Lack of neutral advocacy A central point of criticism: The FIDO Alliance includes Big Tech, interests close to intelligence agencies, and banks – but no consumer protection organizations. In contrast to the W3C (with public interest groups and Tim Berners-Lee). The motivations of the members: Big Tech wants to sell convenience, banks want to get rid of liability, and intelligence agencies want to track.
Also my feelings about this standard
1 Like
“Including big tech” does not mean “excluding neutral advocacy”. Bitwarden, Mozilla, 1Password are there too.
4 Likes
I recommend this response by a person that works in the standard groups (they are employed at Apple) Ricky Mondello: "If you actually read the “Passkeys are a trap. Do…" - Hachyderm.io
A vital part of the spec, WebAuth, literally is work of the W3C FIDO User Authentication Specifications | FIDO Alliance
And not only there, Bitwarden, 1Password and Dashlane were the driving force behind the new transfer API, which is now implemented by both Apple and Google Credential Exchange Format
4 Likes
i got about 25% of the way into that “Passkeys are a trap. Do not use them” article, to the bit where they were praising TOTP. The issue is that TOTP does not have any protection against phishing.
The first comment was “Holy fuck, dude, boil it down! 5000 words later, eyes glazed” which is 
correct 
Tbh, I just use a mixture of both TOTP for low security, and Yubikey for higher security situations. Would be nice to trade out the Yubikey for something better some day. I do agree though storing credentials on the device, eg some sort of chip inside the phone or laptop is kinda crap if you have multiple devices, for that I only really see a security key /w NFC being a viable option.
Which frankly is more realistic. If you want to go conspiracy the other way why not.
3 Likes
That is both a hilarious response and a real possibility I vaguely remember that being a thing with anticheat software. ;D
Could you provide an example of a phishing attack with TOTP? The examples I’ve read about were so targeted that I’d probably recommend the attacker just ask me to tell them the secret directly and not bother with all that effort,
One example would simply be a phishing page that is acting as a proxy and passes through the TOTP code to the real website. That would then give the attacker a valid session.
4 Likes
A rebuttal to this article has been released
2 Likes
off-topic
Well, I’m not sure what “AMAMX” stands for, but assuming you mean “acronym for big tech companies”, the most recent I remember seeing is from a joke in a Fireship video:
- MMAANGO (Meta, Microsoft, Amazon, Apple, Nvidia, Google, OpenAI)
- GAYMMAN (Google, Amazon, Y Combinator, Microsoft, Meta, Apple, Nvidia)
I mean I would certainly argue this is very problematic though.
1 Like
Why? I don’t struggle with companies having their own rules for their clients, but I don’t know what your experience is.
Upd. anyway, my point was that passkeys don’t add anything here: it’s not the case that passkeys change how things work today, so passkeys are not a trap.
They all count as “Big Tech” these days. Especially Mozilla. Who have been;
-
Predominantly funded by Goggle and other DataFarming companies since Mozilla corp was set up to receive those funds.
-
Pushing proprietary components and/or privacy-violating anti-features into vanilla FireFoz for almost as long.
-
Often partnering with dodgy companies pushing proprietary or DataFarming products or services
-
Bandwagon-jumping. Last week the metaverse. This week ActivityPub. This morning “AI”. Meaning they waste donated funds building all sorts of under-designed slop. Much of which gets pushed into FF while its trending, then abandoned when they jump on the next hype train.
-
Paying their CEOs millions of $ a year, even while they lead the organisations down these dead ends.
The managements of Mozilla’s legal entities long ago pissed away the credibility the Mozilla name once carried.
1Password is fashware. So their involvement doesn’t inspire much confidence.
BitWarden I known much less about, but they have a commercial service to sell. Also see their Wikipedia page, which links to recent articles suggesting they’ve been taken over by Business Idiots, like Mozilla, and started to move away from being fully Free Code. So their participation is neutral, at best.
OK, so even if for a second I try to put on your hat, it means paying DHH automatically makes you big tech. The word just means “companies I don’t like,” I guess.
Besides this, even if someone agreed with every point in your post, it still doesn’t contradict the argument it tries to oppose:
“Including big tech” doesn’t mean “excluding neutral advocacy.” Bitwarden, Mozilla, 1Password are there too.
1 Like
Which of course doesn’t include vaultwarden and using official bitwarden apps does it where does DHH get my money in that model.